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The goal of this paper is to extend the framework of finite size analysis recently developed for 
quantum key distribution to continuous-variable protocols. We do not solve this problem completely 
here, and we mainly consider the finite size effects on the parameter estimation procedure. Despite 
the fact that some questions are left open, we are able to give an estimation of the secret key rate for 
protocols which do not contain a postselection procedure. As expected, these results are significantly 
more pessimistic than the ones obtained in the asymptotic regime. However, we show that recent 
continuous- variable protocols are able to provide fully secure secret keys in the finite size scenario, 
over distances larger than 50 km. 



Quantum key distribution (QKD) is a cryptographic 
primitive that allows two distant parties, Alice and Bob, 
to generate secret keys despite the presence of a potential 
eavesdropper PJ. When, in 1984, Bennett and Brassard 
invented the first QKD protocol [2| , they could only prove 
that their protocol had to be secure in some appropriate 
regime (for instance in the unrealistic case where Alice 
and Bob's data are perfectly correlated) but were not 
in measure to establish any security proof for a realistic 
setup at that time. During the last 25 years, security 
proofs have steadily improved and today, unconditional 
security, that is, security guaranteed in an information- 
theoretical sense has been established for many QKD pro- 
tocols 0"H|, including continuous- variable protocols Q- 
A caveat, however, is that any theoretical security proof 
relies on assumptions, which can be more or less explicit. 
One such assumption can be for instance that the phys- 
ical implementation of the protocol behaves as specified, 
and that no side-channels can be exploited by the ad- 
versary. This, unfortunately, is in general impossible to 
prove Q unless one considers device-independent quan- 
tum cryptography [9|, [T(| , which is certainly a fascinating 
theoretical possibility, but highly unpractical. Another 
assumption which is often made is that one considers the 
security of a protocol in the asymptotic regime of in- 
finitely many signals exchanged by Alice and Bob. Here, 
on the positive side, the general framework to address the 
problem of finite-size effects already exists. The specific 
formalism was developed in Renner's PhD thesis Q and 
subsequently detailed in ll| and applied in [12(- Note 



also that another analysis compatible with composable 
security was developed by Hayashi in the case of BB84 
with decoy states [1 31 ] and later applied to experimen- 
tal data [14[. On the negative side, the results of these 



various papers are quite pessimistic and it is not totally 
unreasonable to think that the security of all QKD im- 
plementations realized until now was in fact jeopardized 
due to the (way) too short length of the blocks exchanged 
by Alice and Bob! 

So far, the finite-size analysis has been restricted to 
discrete-variable protocols, that is, protocols described 
with a finite dimensional Hilbcrt space (see Ref. [15| for 
an application to QKD using qudit systems). 

On the other hand, continuous-variable protocols 
where information is encoded in phase space, appear to 
be a credible alternative to historical protocols like BB84. 
Indeed, they are relatively easy to implement, requiring 
only coherent states generation together with homodyne 
detection [16l | and now display very good performances 
in terms of achievable distance [17H19| . 

The basic idea of continuous-variable QKD is to en- 
code information in phase space. To do so, Alice sends 
random coherent states to Bob, who decides randomly 
to measure cither one of the quadratures with a homo- 
dyne detection. (Note that a variant consists for Bob to 
perform an heterodyne detection, that is to measure both 
quadratures simultaneously j20l - |22J .) After this measure- 
ment, Alice and Bob share classical variables x (the value 
of the quadrature of the state sent by Alice) and y (Bob's 
measurement result) from which they can in principle 
distill a key, once they have exchanged sufficiently many 
signals. A few protocols of interest have been proved 
unconditionally secure [7[, depending on Alice's modu- 
lation which can be either continuous (Gaussian [16[ or 
eight-dimensional [19| in order to allow for a very effi- 
cient reconciliation procedure) or discrete (binary |23[ or 
quaternary [13, [l8|). Note that for all such protocols, 
no postselection of the classical data [24| should be per- 



formed, as such a postselection is not compatible with 
present security proofs p3j . 

The goal of the present paper is to give a first finite- 
size analysis for continuous-variable QKD protocols. In 
Section^ we rapidly review the framework of [ill ] . In Sec- 
tion HH we describe the outline of a general continuous- 
variable QKD protocol. Then, we discuss in Section ITO1 
the main specificities of continuous-variable protocols in 
the context of finite-size analysis. We proceed in Section 
IIVI with a detailed study of the most important finite- 
size effect: parameter estimation. Finally, we present 
the results of this study in Section [V] and give some per- 
spectives. 



I. THE GENERAL FRAMEWORK FOR FINITE 
SIZE ANALYSIS 

In the following, we note N the total number of sig- 
nals exchanged by Alice and Bob during the protocol. We 
note x and y the classical data of Alice and Bob, respec- 
tively, after they have measured their quantum states, 
and E refers to the quantum state of the eavesdropper. 

The formalism developed in [6| allows for the following 
generalization of the secret- key rate of a discrete- variable 
QKD protocol which is secure against collective attacks 
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This key rate has to be compared to the asymptotic key 
rate K given by 



K = S(x\E) - H(x\y), 



(2) 



and four differences can be noticed. 

First, only n signals are used for the establishment of 
the key, out of the N signals exchanged. This is due to 
the fact that m = N — n signals are used for parameter 
estimation. This leads to the presence of the prefactor 
n/N in front of the secret key rate. Note that this factor 
is not very critical: it would become relevant if a QKD 
protocol were to be implemented and commercialized as 
it limits the rate of the protocol, but in practice, it has 
little effect on the final rate, say a factor 1/2 if 50% of the 
data are used for parameter estimation. Indeed, the real 
theoretical challenge today is to decide whether a QKD 
protocol can be used to distill a secret key for some given 
conditions (of losses and noise). From this point of view, 
optimizing every possible parameter in order to maximize 
the secret key rate seems a little bit premature. 

Second, the usual conditional entropy S(x\E) has to 
be replaced by the expression S epE (x\E) taking into ac- 
count the finite precision of the parameter estimation. 
Indeed, whereas the quantum channel can be assumed to 
be perfectly known in the asymptotic regime, here, this 
can only be achieved with a finite precision related to the 
probability epe that the true values of the npE channel 



parameters arc not inside the confidence region computed 
from the parameter estimation procedure. Note there is 
never unicity of such a confidence region: one is free to 
optimize his choice among all possible regions compati- 
ble with the failure probability epE- This choice can be 
based on the simplicity of the description of the region 
(for instance the Cartesian product of npE intervals cor- 
responding to each estimated parameter) , or on an opti- 
mization maximizing the final secret key rate, in which 
case the confidence region is a very general region in the 
npE-dimensional space of the parameter space. Unfortu- 
nately, such an optimization is often rather complicated 
to perform, and in general, one chooses confidence re- 
gions with very simple shapes (one is referred to Ref. 
|25j for a discussion of such considerations in the case 
of BB84) . There also exists a trade-off between the de- 
sired level of precision of the parameter estimation (in 
particular, the number npE of parameters one considers) 
and the number m of signals which have to be sacrificed 
to this end. For instance, it is known that for BB84, 
in the asymptotic regime, a full tomography of the state 
increases the secret key rate [26|]. This is not necessary 
true anymore in a finite-size context. In [12J, the authors 
suggest that in the limit where N tends to infinity, the 
optimal number of samples m used for the parameter es- 
timation should be on the order of yN. However, for 
reasonable values of the block length N, the number of 
samples needs to be much larger than y/N, especially in 
the case of continuous- variable protocols. 

For BB84, only one parameter needs be estimated in 
theory: the quantum bit error rate (QBER). In practice, 
however, depending on the implementation, additional 
parameters might need being estimated especially if weak 
coherent states are sent instead of true single photons, for 
instance in the case where the decoy-state technique [27| 
is applied. Using Hocffding's inequality for instance, one 
can find a confidence interval (parameterized by £pe) for 
the QBER such that the true value of the parameter is 
inside the interval with probability at least 1 — epE- In 
the case where several parameters must be estimated (for 
instance in continuous- variable QKD protocols), the no- 
tion of confidence interval should be replaced by a multi- 
dimensional confidence region such that the true value 
of the parameters lies in the region with a probability at 
least 1 — epE- Then one needs to compute the minimum 
value of the conditional entropy S(x\E) compatible with 
the confidence interval: this gives S epE (x\E). Whereas 
this procedure is relatively straightforward for the QBER 
(which is a bounded parameter since < QBER < 1), 
we will see in the following that the question is more in- 
volved for continuous- variable QKD protocols where one 
needs to estimate a priori unbounded parameters such 
as the excess noise. In this paper, we will consider two 
parameters to be estimated in continuous- variable QKD: 
the transmission T and the excess noise £. In principle, 
these are not the only parameters to be estimated in a 
real implementation as one also needs to know Alice's 
modulation variance (as well as the electronic noise and 



the quantum efficiency of the detectors if one considers 
a scenario where Bob's detection is calibrated), but one 
can reasonably assume that this parameter is relatively 
well known, in comparison to T and £. 

Third, leaksc corresponds to the amount of informa- 
tion which needs to be exchanged by Alice and Bob dur- 
ing the reconciliation phase. This quantity is necessarily 
equal or larger than the conditional entropy H (x\y), but 
in practice, it always turns out out be strictly larger than 
the optimal value. We would like to emphasize that the 
effect of an imperfect reconciliation, which is parame- 
terized by leakEC here, was already taken into account 
for the study of continuous-variable QKD through the 
so-called reconciliation efficiency f3. This reconciliation 
efficiency gives the fraction of I(x;y), the mutual infor- 
mation between Alice and Bob's data, that the legitimate 
parties are able to exploit in practice. More precisely, the 
size of the (identical) bit strings shared by Alice and Bob 
after the reconciliation procedure is n/3I(x; y) (the factor 
n is a reminder that only n couples of data are processed 
for the key distillation, the rest being used for parameter 
estimation). This imperfect reconciliation efficiency has 
been for a long time the cause of the limited range of CV 
QKD protocols (and still is for the protocols involving 
a Gaussian modulation). In the case of discrete- variable 
QKD protocols, leaksc is typically modeled as: 

lcak EC ~ hcH(x\y) + - log 2 (2/e E c), (3) 

n 

where /ec > 1 is a parameter characterizing the recon- 
ciliation efficiency (in a slightly different way than (3 for 
continuous-variable reconciliation) and cec is the prob- 
ability that the reconciliation fails and that this failure 
goes undetected by Alice and Bob J44J]. In practice, this 
probability can be made arbitrarily small. 

Finally, the parameter A(n) is related to the security 
of the privacy amplification. Its value is given by: 



A(n) = (2dimHx+3h/ 10S2(2/£) +-log 2 (l/ £pA ), (4) 
V n n 

where T-Lx is the Hilbert space corresponding to the vari- 
able x used in the raw key, e is a smoothing parameter 
and epA is the failure probability of the privacy amplifi- 
cation procedure. Both the smoothing parameter e and 
epA arc intermediate parameters which should be opti- 
mized numerically. The first term of A(n), that is the 
square-root term, actually corresponds to the speed of 
convergence of the smooth min-entropy (which is the ap- 
propriate measure of the key length) of an independent 
and identically distributed (i.i.d.) state (remember that 
we consider collective attacks here) toward the von Neu- 
mann entropy. Indeed, only in the asymptotic limit is 
the smooth min-entropy of an i.i.d. state equal to its von 
Neumann entropy. The second term is directly linked to 
the failure probability epA of the privacy amplification 
procedure. 

Note that if one was to consider general security, it 
would be necessary to add to Eq. [1] another correction 



term linked to the use of the exponential version of dc 
Finetti theorem J28|, or to the postselection technique 
[29j and this would give an even more pessimistic key 
rate. However, in the case of BB84 for instance, collec- 
tive attacks are optimal, even in the case of finite size 
analysis, and such terms are therefore not required. For 
CV QKD protocols, it is also conjectured but not yet 
proven that collective attacks are always optimal. There- 
fore, it makes sense to consider the finite size analysis 
when the eavesdropper is restricted to collective attacks. 
Without the proof of the optimality of collective attacks, 
one could use the bound derived in [7| for the applica- 
tion of an exponential version of de Finetti theorem for 
infinite-dimensional Hilbert spaces. However, because 
this bound, which is not believed to be tight, leads to 
very pessimistic results, we prefer not to take it into ac- 
count here, and therefore limit our analysis to the case 
of collective attacks. 

In the end, one needs to fix an overall security param- 
eter e for the quantum key distribution protocol. Indeed, 
contrary to the more usual asymptotic scenario, no such 
thing as perfect security can exist in a finite-size setting, 
and one is limited to e-security. The (small) parame- 
ter e corresponds to the failure probability of the whole 
protocol, meaning that the protocol is assured to per- 
formed as is supposed to except with a probability at 
most e. Again, here, we do not consider problems due 
to an imperfect implementation, which might lead to the 
existence of side-channels that can be used by an eaves- 
dropper. The failure probability e can be computed from 
the various parameters described above, and in the limit 
of small parameters, one has: 



epE + £ec 



£pa- 



(5) 



Note that all parameters £ec , £j £pa and epA can inde- 
pendently be fixed at arbitrarily low values (possibly by 
increasing the total number N of exchanged signals to a 
rather high value): 

• epE can be made as low as desired simply by in- 
creasing the size of the sample used for parameter 
estimation (and therefore not used for establishing 
a key). 

• cec can be decreased with the following procedure: 
Alice and Bob simply need to compute a hash of 
their respective bit strings after the reconciliation 
and to publicly compare it. This method is very 
interesting because computing a hash acts like an 
error amplification: even if the original strings only 
differ for a few bits out of several millions, their 
hash will be different with a very high probability. 
Hence Alice and Bob can check that they share a 
common bit-string while sacrificing only a negligi- 
ble quantity of data. 

• e and epA are virtual parameters that can be opti- 
mized in the computation. They must simply sat- 
isfy both equalities H] and [5] 



As a consequence, the overall security parameter e can 
be chosen arbitrarily small, to a value corresponding to 
Alice and Bob's wishes. Obviously, this comes at the cost 
of decreasing the final secret key size. 



II. OUTLINE OF A CV QKD PROTOCOL IN A 
FINITE SIZE CONTEXT 



Traditionally, in the asymptotic regime, one can make 
the assumption that the quantum channel is perfectly 
known, before the transmission is even performed. Hence 
the optimization of the various free parameters can be 
made before the exchange of data, and the final secret 
key rate can be in principle known in advance (as long 
as the quantum channel behaves as anticipated). 

In the finite-size scenario, the situation is quite differ- 
ent. In particular, one does not know in advance the char- 
acteristics of the quantum channel. To be fair, even after 
the exchange of quantum signals, the quantum channel 
is only partially known: more precisely, a few relevant 
parameters (QBER for qubit channels, transmission and 
excess noise for continuous- variable channels) arc known 
to lie inside some confidence regions, except with proba- 
bility e PE . 

Even if Alice and Bob do not know in advance the 
properties of the quantum channel they will use, they 
can guess them with a reasonable accuracy, making the 
assumption that no eavesdropper will actually try to con- 
trol the quantum channel. Note that this guess is only 
used in order to a priori optimize various parameters 
of the protocols and consequently maximize the expected 
secret key rate, under a "normal use" of the quantum 
channel. If an eavesdropper is present, the guess made 
by Alice and Bob might not be very good, hence leading 
to an non optimized use of the quantum channel, but the 
security of the key distribution will not be affected. 

For a continuous-variable QKD protocol, the secret 
key rate depends (in the asymptotic limit) on three main 
physical parameters: Alice's modulation variance Va, the 
transmission of the channel T and the excess noise £ 
which corresponds to the noise on Bob's state in excess 
compared to the shot noise. The idea is to optimize Va 
in order to maximize the expected secret key rate. To 
do that, Alice and Bob can guess the values of T and £. 
The transmission can be evaluated quite precisely with 
T w ^io -0 ' 02 ^ where r\ is the known quantum efficiency 
of Bob's detection and d is the distance in kilometers be- 
tween Alice and Bob. Here, we assume an optical fiber 
with losses of 0.2dB per kilometer. In practice, Alice and 
Bob generally have a good estimate of the value of the 
transmission of the quantum channel before they start 
the quantum key distribution protocol. The value of £, 
on the other hand, depends on the quality of the setup 
and turns out to be fairly stable from one experimen- 
tal run of the QKD protocol to the next. Typically, for 
state-of-the-art implementations, its value is around 1% 
of the shot noise [3CJJ ■ Note that this corresponds to the 



expected value of the excess noise. As we will see later, 
the measured value might differ significanty from the the- 
oretical value due to a high statistical noise. 

At the beginning of the protocol, Alice and Bob agree 
on a particular value of the overall security parameter 
e. They also agree on a reconciliation protocol, mean- 
ing that they know the parameter £ec i n advance. Since 
both e and epA are virtual parameters that have to be 
optimized afterwards, the rest of the initial (that is be- 
fore the quantum distribution) optimization consists in 
studying the parameter epe which quantifies the failure 
probability of the parameter estimation. This parameter 
depends on the number m . — N — n of samples used for 
this parameter estimation as well as on some properties 
of the quantum channels such as the expected true values 
of the parameters T and £. Therefore, given the expected 
behavior of the quantum channel, one can infer the value 
of m required to obtain a particular value of the param- 
eter epE- This in turn puts a lower bound on the block 
size N necessary to obtain a e-secure secret key. 

At this point, still before the actual start of the quan- 
tum key distribution protocol, Alice and Bob can op- 
timize the values of the total number N of signal ex- 
changed, the length of the raw key n as well as the opti- 
mal value for Alice's modulation variance Va in order to 
maximize the expected secret key rate compatible with 
the overall security parameter e. The values of N, n and 
Va can be considered to be fixed at this stage. 

Then, Alice and Bob proceed with the quantum ex- 
change part of the QKD protocol: Alice sends N ran- 
dom coherent states (or N/2 for protocols with hetero- 
dyne detection) according to the modulation character- 
izing the protocol (with a modulation variance Va) who 
measures them with a homodyne (or heterodyne) detec- 
tion. Bob informs Alice of his measurement choices (that 
is, for each state, Bob tells Alice whether he measured 
the X or the P quadrature, or both) and Alice discards 
the data that Bob did not measure. They publicly dis- 
close N — n of their correlated data in order to estimate 
the true values of the transmission and excess noise of 
the quantum channel. They can therefore compute the 
value of S epE (y\E), the conditional von Neumann entropy 
of Bob's data (which will be used to form the key in 
a reverse reconciliation procedure) given Eve's quantum 
state, which is compatible with the estimated parameters 
except with probability epe- If this value is compatible 
with a positive secret key rate, Alice and Bob continue 
with the reconciliation procedure, otherwise they abort 
the protocol. At the end of the reconciliation procedure, 
Alice and Bob compute the hash of their respective bit 
strings (for some well chosen hash function, that is, a 
randomly chosen hash function from a family such that 
the equality of both hashes guarantees that the recon- 
ciliation procedure worked except with probability esc 
[4a]). If their strings differ (because their hashes differ), 
Alice and Bob abort the protocol. (Note, however, that 
Alice and Bob might try to continue with the protocol by 
exchanging more classical information in order to com- 



plete the reconciliation procedure.) If their hashes are 
identical, Alice and Bob compute the final key size com- 
patible with the security parameter e (by optimizing over 
e and £pa) and perform the privacy amplification, that is, 
they randomly pick a hash function from a two-universal 
family of hash functions which outputs a string of length 
I, with I = kN the size of the e-secure secret key that 
they can extract from their data. 



III. VARIOUS ISSUES SPECIFIC TO 
CONTINUOUS VARIABLES 

First of all, we would like to emphasize once again 
that we are only considering here collective attacks and 
not general attacks. This decision can be motivated by 
the fact that the optimality of collective attacks has been 
proven asymptotically and that it is conjectured that this 
optimality could hold in a finite-size setting. Moreover, 
the correction terms computed in Q are quite large and 
likely not tight and might hide interesting effects (such 
as the dependence of the key rate on parameter estima- 
tion) behind purely technical details such as (temporary 
?) bounds linked to a particular mathematical proof (ex- 
ponential version of de Finctti theorem for infinite di- 
mensional Hilbcrt spaces). 



A. Dimensionality 

The main difference between discrete-variable and 
continuous-variable QKD protocols is obviously the in- 
finite dimensionality of the Hilbert space required to de- 
scribe CV QKD protocols. This is in general rather prob- 
lematic when studying the security of CV QKD but it 
becomes even more annoying when one considers finite 
size effects. In particular, when one is only interested 
in asymptotic key rates, the dimension problem can be 
solved by saying that in the end, everything in the exper- 
iment is discrete (even the homodyne detection since the 
local oscillator has a finite energy). Therefore, one can 
always theoretically bound the dimension of the relevant 
Hilbcrt space by a number large enough and prove that 
the correction terms due to this large dimension all go to 
zero in the asymptotic limit. 

Unfortunately, for a finite-size scenario, such an ap- 
proach fails as the convergence toward the asymptotic 
rate can be heavily slowed for high dimension. For in- 
stance the finite dimension corresponding to the digital- 
ization is often on the order of d = 2 12 = 4096 if one uses 
12-bit analog-to-digital converters. If one compares such 
a system with a two-dimensional one, equation Q tells 
us that the same A(n) is attained for a n ex d 2 , i.e. for a 
value of n 1.4 • 10 6 times higher in the high-dimensional 
case. The magnitude of such factors clearly shows that 
bounding the dimensionality of the system by a finite 
value is not enough for ensuring its security in practical 
circumstances. This dimension should also be as small 



as possible, and it is important to come up with security 
proofs that are as dimension-independent as possible. 

Fortunately, in some continuous variable protocols [17], 
Il9l . |31| . the raw key is encoded on bits, and this allows 
us to take dimHy = 2 for the numerical evaluation of 
the section [V] 

When this is not possible, one should be able to replace 
the real dimension of the system by its effective dimen- 
sion, but this remains essentially an open question. 

Such an effective dimension is generally much smaller 
than the real dimension and is sufficient to capture the 
relevant features of the continuous-variable system. Dif- 
ferent definitions for this effective dimension can be pro- 
posed. Generally however, one defines the effective di- 
mension d\ of a mixed system p as: 



df{ P ) 



1 
tr^ 



(0) 



which quantifies the number of states over which p is 
spread 32|. For instance, a totally mixed state over N 
orthogonal states has c^ ff = N. A more speculative vari- 
ant would be to remember that according to [33[, the 
proper max-entropy 7J max of a state is not given by the 
Renyi entropy of order (which diverges for any quan- 
tum state of a CV system) but by the Renyi entropy of 
order 1/2. Therefore one could also define the effective 
dimension d^ as the exponential of this entropy, that is 



df{p) = (tr^p) 2 . 



(7) 



The advantage of the first definition is that it relates 
to the energy of the state, and that it is automatically 
bounded, for any (physical) state p. 

In order to be rigorous, the above effective dimension 
defined above will probably be defined under the form of 
"smooth dimensions" , depending on a small parameter 
e, in a way similar to the smooth-entropies introduced in 
[34| . which have allowed to look at the finite-size effect. 
In any case, it is intuitively clear that ultimately, it is 
such effective dimensions that should appear in security 
proofs of CV QKD protocols. This question certainly 
needs to be investigated further. We stress again that 
such a problem, which is rather benign in the asymptotic 
limit, plays a crucial role in a finite-size analysis. 



B. Ill-defined entropies for continuous variables 

Another specificity of CV QKD is that classical en- 
tropics arc ill-defined for continuous variables: the Shan- 
non entropy has to be replaced by a differential entropy, 
which is not a practical quantity to analyze secret key 
rates. For this reason, the expression 



Se FE (y\E) 



leak 



EC 



(8) 



is inadequate for CV QKD. The solution is to rewrite 
the different quantities in terms of mutual information 



instead of relative entropies. Hence, the previous expres- 
sion can be replaced by 



pi(x : y) - S epE (y : E) 



(9) 



in the case of a CV protocol. Here /3I(x : y) gives the 
amount of mutual information Alice and Bob were ef- 
fectively capable to extract through the reconciliation 
phase: (3 is the reconciliation efficiency which ranges 
from when no information was extracted to 1 for a per- 
fect reconciliation scheme. While S tpE (y\E) is defined as 
the minimum conditional entropy compatible with the 
statistics given by the parameter estimation except with 
probability epE, S epB (y : E) is naturally defined as the 
maximum of the Holcvo information compatible with the 
statistics except with probability epE. Hence, in the case 
of a continuous-variable QKD protocol, the secret key 
rate obtained for a finite size analysis reads: 



k = - (f3I(x : y) - S epE (y : E) - A(n)) . (10) 



C. Reconciliation efficiency 

Whereas the question of error-correction was never a 
crucial issue for DV protocols where it just implied a 
small correction term, the same is not true for CV proto- 
cols without postselection. For these schemes, Alice and 
Bob need to be able to extract their mutual informa- 
tion very efficiently The absence of efficient reconcilia- 
tion protocols working in the low Signal-to-Noise Ratio 
(SNR) regime was, for a long time, the reason why CV 
protocols could not distribute secret keys as far as their 
DV counterparts. To be more precise, a reconciliation 
protocol is considered efficient if j3 is larger than roughly 
80%. For such efficiencies, the correction term appears 
quite negligible and has a limited impact on the QKD 
protocol. For a Gaussian modulation, the best known 
protocols achieve efficiencies higher than 80 % only for 
SNR larger than 1 HH, |H, H| . For lower SNR (relevant 
to increase the range of the protocol), no good proto- 
col is known for the reconciliation of correlated Gaussian 
variables. Fortunately, this problem can be solved in this 
regime by switching to a discrete modulation where ef- 
ficient protocols are available for all SNR lower than 1 

a 

To summarize, both modulation schemes (Gaussian 
and discrete) are useful depending on the working dis- 
tance of the protocol. When working at short distances, a 
Gaussian modulation should be chosen whereas a discrete 
modulation is more adapted to reach longer distances. In 
both cases, the effect of imperfect reconciliation can be 
taken care of by taking j3 = 0.8 which is a conserva- 
tive value consistent with state of the art reconciliation 
schemes. Note that one can make the best of both worlds 
(continuous and discrete modulation) by using a specific 
eight-dimensional continuous modulation (see Ref. [19| 
for a detailed presentation of such a protocol) . 



IV. PARAMETER ESTIMATION 

For discrete-variable QKD protocols, it turns out that 
the principal finite-size effect, in terms of its consequences 
on the secret key rate, is the parameter estimation [13 |. 
A similar situation is expected for continuous-variable 
protocols, the main problem being without any doubt, 
the estimation of the excess noise £. 

In this section, we study the parameter estimation pro- 
cedure for continuous-variable protocols, without post- 
selection. Quite fortunately, despite being described in 
an infinite dimensional Hilbert space, these protocols dis- 
play only a few parameters that need to be estimated: 
these are the parameters characterizing the covariance 
matrix of the state shared by Alice and Bob in the 
entanglement-based version of the protocol [37| ■ On the 
positive side, this covariance matrix can be symmetrized 
through a technique similar to the one explained in [381 ] . 
and this symmetrized version is described by only two 
unknown parameters (in addition to Alice's modulation 
variance). On the negative side, in order to be able to 
estimate the two relevant parameters, it seems that one 
still has to make the assumption of a Gaussian channel. 
This does not look as a very constraining assumption as 
it is known that Alice and Bob can always assume their 
state to be Gaussian (see |17J)- However, this result has 
only been established in the asymptotic limit, and one 
cannot yet rigorously exclude the (improbable) situation 
where this result does not hold in general. 

A non-Gaussian attack that would exploit such a pos- 
sible loophole would have to be quite subtle. Indeed, the 
usual security proof stating that Gaussian states are the 
ones which minimize the secret key rate cannot be used 
here because the proof implicitly assumes the knowledge 
of the covariance matrix. For a given covariance matrix, 
the state maximizing Eve's information is Gaussian. The 
only possible loophole would be that because the covari- 
ance matrix is not perfectly known in a finite-size sce- 
nario, there might exist a non-Gaussian state, compatible 
with the estimated covariance matrix computed with a 
Gaussian assumption, that would be better for Eve than 
the Gaussian state estimated by Alice and Bob. Let us 
detail things a little. Let us note <Sf PE the set of states 
compatible with the results of the parameter estimation, 
under a Gaussian model, except with probability epe- 
Let us note 5™ p 9 E the set of states compatible with the re- 
sults of the parameter estimation, under a general, non- 
Gaussian model, except with probability epe- It is not 
easy to compare the two sets a priori, but one can imag- 
ine that they likely get closer and closer as epE goes to 
(we typically consider eps = 10~ 10 ). In the following, 
because we make the Gaussian assumption, we consider 
the Gaussian state p 9 £ 5f PE which maximizes Eve's in- 
formation (note that 5f PE is not composed of Gaussian 
states only, but we know that the worst case from Alice 
and Bob's point of view is Gaussian). However, it is not 
yet possible to exclude the existence of a non-Gaussian 
state p ng £ <S£jf such that the secret key rate obtained 



for p ng is strictly lower that the one obtained for p 9 
is however quite unlikely. 

For this reason, we conjecture that the Gaussian op- 
timality still holds in a non-asymptotic scenario, and in 
the following, we make the assumption of a Gaussian 
channel. Again we insist on the point that even if this 
conjecture were proven wrong, the bounds computed here 
would still be quite accurate. 

Note, however, that this conjecture was recently estab- 
lished in the case of protocols with a Gaussian modula- 
tion mi. 

Our goal, here, is to compute 5 epE (j/ : E), the maximal 
value of the Holevo information between Eve and Bob's 
classical variable compatible with the statistics except 
with probability £pe- The nice property of CV protocols 
without postselection is that S(y : E) can be bounded 
from above by a function of two parameters only. More 
precisely, this function depends on the covariance matrix 
Tab of the state pab shared by Alice and Bob in the 
entanglement-based version of the protocol (see |39M4l| 
for protocols with a Gaussian modulation and [13, 03 for 
protocols with a discrete modulation). One can always 
assume that Tab take the following form: 



This In order to compute S erE (y : E), one simply needs to 



(Va + 1)1 2 

TZa z (TV A 



TZa z 
I + TOI2 



(11) 



where Va is the variance of Alice's modulation in the 
prepare and measure scheme and T and £ refer to the ex- 
perimentally estimated effective transmission and excess 
noise of the channel [38| . The parameter Z is a function 
of Va which depends on the modulation scheme. For in- 
stance, one has: Zo ausB = \fV\ + 2Va in the case of a 
Gaussian modulation. For a discrete modulation, Z has 
a more complicated expression but turns out to be al- 
most equal to Zcauss for small variances (see [13]) : for 
the two-state protocol, one has 



Z 2 = V A 



1 



-2V A 



VT 



-2V A 



and for the four-state protocol, one has 

/ , 3/2 ,3/2 ,3/2 \3/2" 

Z 4 = V A I A ° ' Al ' 2 ' 3 



X 



1/2 .1/2 ,1/2 .1/2 



A 



A 



A, 



where 
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(12) 
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Finally, for the continuous eight-dimensional modulation 
fl9j . one has: 



Z 8 = ^ 



1 -2V^V VkT^ k+ 



E 

fc=0 



V A 



These various parameters are related through: 
Z2 < Za < Za < Z a . 



(15) 



(16) 



evaluate r £PE , the covariance matrix compatible with the 
data except with probability epE which maximizes the 
Holevo information between Eve and Bob's classical data. 
The estimation of T epE is made through the sampling of 
m = N — n couples of correlated variables (xt, yi)i = \... m - 
As we said before, we consider here a normal model for 
these variables. Within this model, Alice and Bob's data 
are linked through the following relation |46j : 



y = tx 



(17) 



which is a normal linear model parametrized by t = 
VT e M. and where z follows a centered normal distri- 
bution with unknown variance a 1 = 1 + T£. The random 
variable x can be either a normal random variable with 
variance Va in the case of the CV QKD protocol with a 
Gaussian modulation, or an unbiased Bernoulli random 
variable taking values ±\/Va in the case of the two- and 
four-state protocols (and a similar situation occurs for 
the continuous eight-dimensional modulation). At this 
point, it is worth considering the dependence of S(y : E) 
in the variables t and a 2 . One can in particular check 
numerically that the following inequalities hold for any 
value of the modulation variance Va and for all modula- 
tion schemes considered here: 



dS(y : E) 



dt 



< and 



dS(y : E) 



dc 



>0. 



(18) 



This means that one can find the covariance matrix r epE 
which minimizes the secret key rate with a probability at 
least 1 — 6pe: 

r = /tVa + i)i 2 t min Zcr z \ , . 

iepE {t min Za z (t 2 mhl VA + al ax )l 2 J' [lJ) 

where t m - ln and o"^^ correspond respectively to the min- 
imal value of t and the maximal value of a 2 compatible 
with the sampled data, except with probability €pe/2. 
Note that this means that the confidence region we con- 
sider here is simply a two-dimensional rectangle. One 
could obviously study more complicated regions that 
might slightly improve the final key rate. However, here, 
we prefer to restrict ourselves to this simpler solution 
which has the advantage of displaying the same features 
as a more complicated model, but without drowning 
them under too technical mathematical details. 

Maximum-Likelihood estimators t and a 1 are known 
for the normal linear model |42j ]: 

i= ^ Xi l i and ^ = -£( W -&i) a . (20) 

Moreover, t and a 2 are independent estimators with the 
following distributions: 



i~Af(t, 



Em 



and 



X 2 (m-1), (21) 



where t and a 2 are the true values of the parameters. 
This allows us to compute i m i n , a lower bound for t, and 
CT^ax: an upper bound for a 2 in the limit of large m [471 ]: 




t z e PE /2y mV A 



(22) 



where z epE / 2 is such that (1 - crf(z epE / 2 /\/2)/2 = eps/2 
and erf is the error function defined as 



erf(x) = —p= 

\/1T 



dt. 



(23) 



In a given experiment, one can simply compute the 
values of both estimators t and a 2 and plug them in the 



Eq. 



| in order to get the values of £ m i n and cr^ aax and 



finally the value of S epE (y : E). In order to keep analyz- 
ing the protocol from a theoretical point of view, we take 
for t and <r 2 their expected values: 



E[t] 

m 2 \ 



/T, 
1 + T£. 



(24) 



noise [30J , then the number of samples required scales as 
a function of the transmission as 



10 b 

y2 



(29) 



For instance, if the distance between Alice and Bob is 50 
km, then T = 1CP 1 which means that one expects the 
block length to be on the order of 10 8 , which is barely 
realistic. If the distance is 100 km, then the block length 
should be on the order of 10 10 , which is much more com- 
plicated. We will see in Section [V] that the reality is even 
worse than that. 

Before proceeding with the numerical results, we now 
discuss two technical points linked to the problem of pa- 
rameter estimation. First, we come back on the assump- 
tion made previously that in a typical experiment, the 
value of the estimators will roughly correspond to the 
true value of the parameter. Then, we hint on alternative 
approaches to improve the estimation of the parameters 
for CV QKD protocols, which might be more economical 
in terms of the number of samples required, but whose 
mathematical analysis is much more involved. 



Using these values, one can compute i m i n and o~ 
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Finally, one gets the covariance matrix r cpE which 
should be used to compute the expected secret key rate 
S epE (y : E) in the finite case: 
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with 



A z = -z epE /2 



1+Tg 
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2vm) + zi E/2 1 -^. 



At the first order, for long distances, the main effect is 
clearly the uncertainty on the excess noise. The effective 
excess noise A m £ due to the imprecision of the estimation 
is given by: 



A m £ 



2 ep E /2 



V2 



T\/rn 



(27) 



We will display in the next section the effect of the pa- 
rameter estimation on the secret key rate, but we can 
already give a hint about the block length that will gen- 
erally be required for a given distance. Indeed, from Eq. 
I27[ one immediately obtains: 



m 



2Z W2 

T 2 A m e' 



(28) 



For epE = 10 , one has z epE /2 ~ 6.5, and if one requires 
A m £ ss 1/100, which is a typical value for the true excess 



1. Expected secret key rate or most probable secret key rate. 

For a given experiment, the secret key rate can be 
computed and is a function of the observed values of 
the estimators t and a 2 (but not only). One can write 
^cxp = f{t,0 ). ^From a theoretical point of view, that 
is, without performing the actual experiment, there are 
two different secret key rates that can be computed. 

The first possibility, considered for instance in J12l |. 
is to compute the secret key rate k\ obtained for the 
expected values of the parameters: 



h = f(E[t\,E[a 2 }) 



(30) 



In some sense, this corresponds to what one could call 
the most probable secret key rate. This interpretation, 
however, is not correct. 

The correct theoretical secret key rate fc 2 is given by 
the expected value of the secret key rate, that is 



fc 2 =E[/(i,cr 2 )]. 



(31) 



Obviously, this value is much more difficult to evaluate 
in general as one needs to know the probability distribu- 
tions of both estimators t and & 2 , whereas in the case of 
k\, one just needs to know the expected values. Fortu- 
nately, we will see in Section |V] that in fact both values 
are remarkably close, meaning that one can always safely 
use fci as the secret key size. 



2. More economical parameter estimation procedures. 

An interesting characteristics of continuous-variable 
QKD protocols is that it might be possible to per- 
form the parameter estimation without sacrificing any 



data. This is obviously something impossible in discrete- 
variable QKD where estimating the quantum bit error 
rate (QBER) requires for Alice and Bob to disclose part 
of their data. 

In continuous-variable QKD however, the bit used for 
the raw key is encoded in only a part of Bob's classical 
data. Let us take the example of the four-state protocol 
for instance [13]. In this case, Bob's data {yi}i<i<N are 
real numbers and the raw key elements are simply given 
by the sign of the variables yi. The absolute value is 
sent to Alice through the public, authenticated channel, 
and Alice uses it to perform the reverse reconciliation 
procedure. 

In the parameter estimation procedure that we de- 
scribed above, Alice and Bob would agree on a certain 
subset of their data and completely disclose their data 
in this subset. This means that the absolute values of 
the rest of Bob's data are not used for this parameter 
estimation, whereas it manifestly contains information 
concerning the covariance matrix of the state shared by 
Alice and Bob. One could certainly use this informa- 
tion to improve the accuracy of the parameter estima- 
tion, or equivalcntly, obtain the same accuracy while us- 
ing less samples, therefore increasing the final secret key 
rate. However, the statistics techniques necessary for this 
study are beyond the scope of this paper, and we do not 
address this question more extensively here. 

Before concluding this section, we give another possible 
way to improve upon the parameter procedure presented 
here. For continuous-variable QKD protocols, it is clear 
that the critical parameter to estimate is the excess noise. 
The transmission on the other hand is less critical for 
two reasons: first, it can be estimated more precisely 
than the excess noise with the same amount of data (in 
particular, the relative uncertainty for the transmission 
is smaller than the one for the excess noise) , and second, 
the secret key rate is much more sensitive to variations 
in the excess noise than in the transmission. Therefore, 
one could use the following method in order to estimate 
the transmission and the parameters: 

• the transmission is estimated through the same pro- 
cedure as before, with m samples, 

• Bob uses the totality of his data to compute an 
estimation of the variance of his data. Then using 
the relation (y 2 ) = 1 + TVa + T£ and his estimation 
of T, Bob infers an estimation for the excess noise. 

This approach seems better than the one studied above. 
However, it involves computing two dependent estimators 
and the probability distributions of the estimators (nec- 
essary to compute confidence regions) are not known. 

Therefore, in this paper, we use a likely suboptimal 
procedure to perform the parameter estimation, but this 
procedure allows for the computation of explicit bounds. 
The question of what is the best parameter estimation 
procedure in the case of continuous- variable QKD is still 
open, and is certainly worth investigating further, as it 



turns out that the parameter estimation is an important 
problem if one wants to distribute secret keys over long 
distance, while using realistic block lengths. 



V. RESULTS 

Before we discuss the results in terms of secret key rate, 
we start by considering the specific influence of A(?i), 
related to privacy amplification and defined in eq. Q. 
We then study the influence of the parameter estimation. 



A. Influence of A(n) 

On Figure [I] we plot the value of the parameter A(n) 
as a function of n, the size of the raw key. Here, we take 
dim'H.Y = 2 since for all continuous-variable protocols 
we consider, the raw key is encoded on bits [13, fl3.[3l|. 
Among notable features, one sees that the value of A(n) 
does not critically depend on the parameters e and epA 
which need to be optimized in theory. One can easily see 
from the curve, that for the plotted domain (n > 10 4 ), 
A(n) is essentially determined by the first term of eq. (|4|), 



5(n) ~ 7 



log 2 (2/e) 



(32) 



The important lesson is the large value of A(n), even for 




Figure 1: (Color online.) Parameter A(n) as a function of 
n for various values of e and epA- From top to bottom, e = 



e PA = Kr°,10 , l(T H ,l(r 



,10" 



(secmingly) quite large sizes of the raw key. In particular, 
one observes that A(n) is larger than 0.01 for raw key 
sizes smaller than 10 7 . In practice, this means that if the 
asymptotic secret key rate is below 0.01 bit per channel 
use, then if one wants to take into account finite-size 
effects, one has to use block lengths larger than 10 million 
in order to be able to claim to have truly distributed a 
secret key among distance parties. 
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B. Influence of the parameter estimation 

Here, we focus on the value of the effective excess noise 
A m £ due to the finite precision of the parameter estima- 
tion. On Figure [31 we display this effective excess noise 
as a function of to, the number of samples used in the 
parameter estimation. From Figure [21 it is clear that 




Figure 2: (Color online.) Parameter A m £ as a function of m 
for epE = 1CP 10 (in fact, A m £ does not depend too critically 
on the precise value of epb, and one obtains almost similar 
plots for epE = 1CP 5 for instance). From bottom to top, 
we consider channel losses of 5 dB, 10 dB, 15 dB and 20 dB. 
With a perfect homodyne detection (quantum efficiency equal 
to 1), this is equivalent to distances of 25, 50, 75 and 100 km, 
respectively. 



The choice for e is a very conservative choice, but it turns 
out that the secret key rate does not depend very criti- 
cally on e (a similar observation was made in |ll|). The 
choice to use half of the data for the parameter esti- 
mation procedure results from the fact that the block 
size is almost entirely decided by the number of data ac- 
tually sampled. The reconciliation efficiency of 80% is 
a conservative value [13, bLL|. Finally, we consider the 
quantum efficiency of the homodyne detection to be 60% 
which corresponds to a typical experimental parameter 
|30j. Moreover, we consider the paranoid mode where 
the electronic noise is null. Remember that two different 
models can be considered when discussing the security of 
CV QKD: either the electronic noise of Bob's detection 
is considered as regular excess noise (paranoid mode) , or 
it is attributed to Bob's detection (realistic mode). The 
second case is more natural, but it implies that Bob's 
detection stage should be calibrated. As a first approx- 
imation, the paranoid mode without electronic noise is 
equivalent (in the asymptotic regime) to the case of a 
realistic mode where the electronic noise is non negligi- 
ble but is not supposed to be caused by the action of 
an eavesdropper. In the finite-size regime, one can still 
make the assumption that Bob's detection is very well 
calibrated and that there is virtually no uncertainty on 
the value of the electronic noise. As a consequence, in or- 
der to avoid too many technical details, we present here 
results obtained in the paranoid scenario without elec- 
tronic noise. Note that this solution was also chosen in 
the review by Scarani et al [l|. 



the parameter estimation has a major impact on the fi- 
nal secret key rate. Indeed, the four-state protocol for 
instance, which can achieve remarkably long distances 
in the asymptotic limit, requires very low values of the 
excess noise, typically less than one percent in order to 
distribute key over distances close to 100 km. Here, we 
see that such parameters require to sample 10 billion cou- 
ples of correlated data! For this reason, it is doubtful that 
continuous- variable QKD is very practical over distances 
much larger than 100 km, at least with the security proofs 
presently available. Note that a similar situation is also 
true for discrete-variable protocols. 



C. Secret key rate in the finite-size scenario 

Here, we first consider the secret key rate k\ which is 
the one obtained if the estimators i and a 2 are equal to 
their expected values. We do not proceed to a complete 
optimization of the various parameters since it will not 
fundamentally change the results and instead take the 
following values: 

«ec = e = e PA = epE = 10~ 10 , 

e«10- 10 , 

to = n = N/2, (33) 

j3 = 80, % 

r/ = 0.6. 
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Figure 3: (Color online.) Secret key rate for the four-state 
protocol. From left to right, the curves correspond respec- 
tively to block lengths of N = 10 8 , 10 10 , 10 12 and 10 14 . Full 
lines, dashed lines and dotted lines correspond respectively 
to an expected value of the excess noise of 0.001 (optimistic), 
0.005 (realistic), 0.01 (conservative). The secret key rate is 
null for a block length of 10 6 . 

The secret key rates displayed on Figure [3] correspond 
to the key rate one can expect if the estimators give the 
true value of the parameters. As we argued above, a 
more relevant secret key rate corresponds to the expected 
value computed for the probability distributions of the 
estimators i and a 2 . 
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As we already explained, the most important parame- 
ter for the final secret key rate is the excess noise. This 
means that one should mainly consider the probability 
distribution of the estimator a 2 . According to Equation 
|2T1 one has: 



X 2 (m-1). 



(34) 



For large m, the x 2 distribution tends to a normal dis- 
tribution, which translates into 



•Af 



2a 4 



(35) 



where, as before, a 2 corresponds to the true value of the 
parameter. Here, we can therefore compute an approxi- 
mate value of the expected secret key rate k 2 as 



k 2 =E[f(i,a 2 )]^E[f(t,& 2 )} 



(36) 



since i has a probability distribution peaked around the 
true value of the parameter t and because / does not 
depend critically on the value of t. Using the normality 
of the random variable a 2 , one obtains 



fc 2 = 



1 
2^ 



m 
— exp 



(s - a 2 
4^" 



f(t,s)ds. (37) 



It turns out that the behavior of ki is numerically in- 
distinguishable from the value of k\ . For this reason, we 
do not display it here. The main consequence is that one 
can in very good approximation compute the final key 
rate by considering the expected values of the parameters 
being estimated. This is rather fortunate as computing 
&2 is much more demanding from a computing point of 
view than computing k\. 

Finally, on Fig. El we display the results for the re- 
cently proposed eight-dimension protocol described in de- 
tail in ref. [19| , which outperforms the four-state protocol 
in realistic cases, and may also be easier to implement. 



VI. PERSPECTIVES 

This article laid down the basis of finite-size analysis of 
continuous- variable QKD protocols, but several problems 
remain open, and should be addressed in further studies. 

First, a basic tool used in the asy mptotic regime is 
the Gaussian optimality theorem J40L |41| , which remain 
valid for collective attacks, even in the case of the pro- 
tocols which do not use a Gaussian modulation, that is, 
the protocols designed to perform well over long distance 
J171 Il9j . Whereas using this theorem is completely legit- 
imate in the asymptotic regime [4(J, EJ , it is not so clear 
in a finite-size scenario, where very subtle (and highly 
improbable) attacks might perform slightly better. Such 
attacks would have to be based on the idea of fooling Al- 
ice and Bob by having them make wrong assumptions in 
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Figure 4: (Color online.) Secret key rate for the four-state 
(thin curves) and eight-dimension (thick curves) protocols ob- 
tained for an expected realistic value of the excess noise of 
0.005, and for e PE = 10~ 10 . From left to right, the block 
length AT is equal to 10 8 , 10 10 , 10 12 and 10 14 . The secret key 



rate is null for a block length of 10 6 . 
protocol is better for all curves. 



The eight-dimension 



the parameter estimation procedure. This subtle point 
(given that the blocks have anyway to be very large) de- 
serves further analysis. 

Second, and perhaps more importantly, one should 
prove whether or not collective attacks are optimal in 
the finite-size setting. If this is the case, then all is for 
the best, and the bounds derived here are accurate. But 
if collective attacks are not optimal, then one needs to 
come up with bounds as tight as possible for coherent 
attacks. On this subject, it would seem that adapting 
the postselection technique from [29( to continuous vari- 
ables (using for instance symmetries in phase space as 
explained in [38|) would lead to much tighter bounds that 
the one currently available through an exponential ver- 
sion of de Finetti theorem for infinite dimensional Hilbert 
spaces [7J]. 

Despite the fact that there are still open problems 
concerning the finite size analysis of continuous- variable 
quantum key distribution, some lessons can already be 
learned. First, it should be emphasized again that the 
problem of the reconciliation efficiency at low SNR is es- 
sentially solved by new protocols using discrete modula- 
tion and high-efficiency reconciliation codes, such as the 
four-state [l7| or eight-dimension [19[ protocols. Then, as 
is the case for discrete- variable QKD protocols, the most 
important remaining finite-size effect is the limited accu- 
racy of the parameter estimation. For CVQKD, the main 
issue is the value of the channel excess noise, which has 
already a critical effect for values as small as 1% of shot 
noise. Nevertheless, operating windows do exist, pro- 
vided that both the "real" excess noise is very small, and 
the block size is very large. Under such circumstances, 
secure key distribution over distances larger than 50 km 
seem quite feasible, especially with the eight-dimension 
protocol [19| , as it has been shown on Fig. @] 
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